Homebrew AES key scrambler

[motezazer]

About the keyY, https://github.com/mid-kid/CakesForeveryWan/blob/master/patches/emunand/info.json#L160 may help. I didn't bother tracing that function yet because I don't have a 8.1/9.0 decrypted arm9bin yet, and without that, I can't proceed anyway.

The KeyY is in 9.3+, but thanks for the info.

 

[Suiginou]

The KeyY is in 9.3+, but thanks for the info.

The statements are separate.

The link refers to the location of aes_setkey in the firmware CakesFW, which is 9.5.

I stated that I personally didn't bother following this trace because I'd be missing one key anyway, the 8.1/9.0 normalkey.

 

[motezazer]

The statements are separate.

The link refers to the location of aes_setkey in the firmware CakesFW, which is 9.5.

I stated that I personally didn't bother following this trace because I'd be missing one key anyway, the 8.1/9.0 normalkey.

Wonderful, I have the 9.5 FIRM!

 

[Suiginou]

Wonderful, I have the 9.5 FIRM!

Word of warning, aes_setkey is the function to set an AES key, not the function that sweepingly sets AES keys initially, see https://github.com/mid-kid/CakesForeveryWan/blob/master/patches/emunand/patches.s#L68

Thus you're looking for functions that reference aes_setkey, not to find what aes_setkey does. If you have a decent disassembler, that may be considerably less painful than finding references in objdump.

 

[windwakr]

keyY is set by PSPXI:EncryptDecryptAes. Pretty easy to find.

SHA1 of it is 801FC53B2273939C6A193F3669E07BA990C6B57D.

 

[motezazer]

keyY is set by PSPXI:EncryptDecryptAes. Pretty easy to find.

SHA1 of it is 801FC53B2273939C6A193F3669E07BA990C6B57D.

I know it's pretty easy to find, but I'm very bad in RE. Thanks for the hash anyways.

 

[Suiginou]

keyY is set by PSPXI:EncryptDecryptAes. Pretty easy to find.

SHA1 of it is 801FC53B2273939C6A193F3669E07BA990C6B57D.

Welp, that gave it away. Off to find the normalkey!

 

[Xenon Hacks]

So once you guys get the normalkey what is the end goal? full arm9 control?

 

[motezazer]

So once you guys get the normalkey what is the end goal? full arm9 control?

No, having the C constant.

 

[Xenon Hacks]

No, having the C constant.

Which gives you access to more services? im just really trying to keep up with whats going on here but im not a dev and terms are getting flung around I don't understand. What do you hope to achieve by doing all of this?

 

[Duo8]

Which gives you access to more services? im just really trying to keep up with whats going on here but im not a dev and terms are getting flung around I don't understand. What do you hope to achieve by doing all of this?

Completely breaking the keyscrambler.

 

[Xenon Hacks]

Completely breaking the keyscrambler.

Which lets you do what?

 

[Duo8]

Which lets you do what?

Decrypt/encrypt on something other than the 3DS, for example, provided you have the keys.
Or to find missing key in a keypair.

 

[peteruk]

if/when all keys are found, could this allow a way to increase the 9.5 restriction on n3ds emunand ?

 

[motezazer]

if/when all keys are found, could this allow a way to increase the 9.5 restriction on n3ds emunand ?

No, for that you currently need a sysNAND 9.6+ and ntrcardhax.

 

[peteruk]

No, for that you currently need a sysNAND 9.6+ and ntrcardhax.

thanks for the fast reply and clarification

 

[dark_samus3]

No, for that you currently need a sysNAND 9.6+ and ntrcardhax.

Where did you get this info? That's pretty much the point of getting these keys

 

[motezazer]

Where did you get this info? That's pretty much the point of getting these keys

The keys are not dumpable. So to have emuNAND 9.6+, you need to have the keys loaded for you, so you need sysNAND 9.6+

 

[dark_samus3]

The keys are not dumpable. So to have emuNAND 9.6+, you need to have the keys loaded for you, so you need sysNAND 9.6+

Lol they aren't dumpable, you're right, so we solve the hardware scrambler and then you can figure the keys out instead if dumping them

 

[motezazer]

Lol they aren't dumpable, you're right, so we solve the hardware scrambler and then you can figure the keys out instead if dumping them

When we'll figure out the key scrambler, if we have two elements out of three (KeyX,KeyY,normalKey), we'll be able to compute the third.
However, for 9.6+ keys, we have only ONE element, the KeyY. So we can't use the keyscrambler knowledge for that.